US9838198B2ActiveUtilityA1

Splitting S-boxes in a white-box implementation to resist attacks

65
Assignee: NXP BVPriority: Mar 19, 2014Filed: Mar 19, 2014Granted: Dec 5, 2017
Est. expiryMar 19, 2034(~7.7 yrs left)· nominal 20-yr term from priority
Inventors:Wil MichielsJan Hoogerbrugge
G09C 1/00H04L 9/002H04L 9/0618H04L 2209/16H04L 2209/043H04L 63/1466H04L 2209/24
65
PatentIndex Score
1
Cited by
18
References
30
Claims

Abstract

A method of performing a keyed cryptographic operation mapping an input message to an output message, wherein the input message comprises m input data and the output message comprises m output data and wherein the cryptographic operation includes at least one round and the cryptographic operation specifies a substitution box for mapping input data into output data, including: transforming each of the m input data into n output data using n split substitution boxes, wherein the n split substitution boxes sum to the specified substitution box; and mixing and combining the m×n output data.

Claims

exact text as granted — not AI-modified
What is claimed is: 
     
       1. A method of performing a white-box keyed cryptographic operation mapping an input message to an output message, wherein the cryptographic operation implementation is a white-box cryptography implementation, wherein the input message comprises m input data and the output message comprises m output data and wherein the cryptographic operation includes at least one round and the cryptographic operation specifies a substitution box for mapping input data into output data, comprising:
 transforming each of the m input data into n output data using n split substitution boxes, wherein the n split substitution boxes sum to the specified substitution box and wherein the output data of the n split substitution boxes is secretly encoded and the encoding is different for each of the n split substitution boxes, wherein the secret encoding is integrated into the n split substitution boxes and the secret encoding hides the output value of the n split substitution boxes from an attacker; and 
 mixing and combining the m×n encoded output data. 
 
     
     
       2. The method of  claim 1 , further comprising m sets of n split substitution boxes, wherein all of the sets of n split substitution boxes applied to each of the plurality of input data are different from one another and the n split substitution boxes sum to the specified substitution box. 
     
     
       3. The method of  claim 1 , further comprising m sets of n split substitution boxes, wherein at least two of the sets of n split substitution boxes applied to each of the plurality of input data are different from one another and the n split substitution boxes sum to the specified substitution box. 
     
     
       4. The method of  claim 1 , wherein mixing and combining the m×n encoded output data includes at least one of the n outputs of each of the m sets of outputs is combined with at least one output of another set n outputs before the at least one of the n outputs is combined with the remaining n−1 outputs of its set of outputs. 
     
     
       5. The method of  claim 1 , wherein the input data is unencoded data input into a first round of the keyed cryptographic operation. 
     
     
       6. The method of  claim 1 , wherein the combined output data is used to calculate a portion of the output message, wherein the output message is an unencoded output of the last round of the keyed cryptographic operation. 
     
     
       7. The method of  claim 1 , wherein the cryptographic operation is the Advanced Encryption Standard. 
     
     
       8. The method of  claim 1 , wherein the cryptographic operation is the Data Encryption Standard. 
     
     
       9. The method of  claim 1 , wherein transforming an input data into n output data using n split substitution boxes is implemented using a n lookup tables corresponding to the n split substitution boxes, wherein the n lookup tables combine the n split substitution boxes with a cryptographic key. 
     
     
       10. The method of  claim 1 , wherein transforming an input data into n output data using n split substitution boxes is implemented using a n finite state machines corresponding to the n split substitution boxes, wherein the n finite state machines combine the n split substitution boxes with a cryptographic key. 
     
     
       11. A non-transitory machine-readable storage medium encoded with instructions for execution by a white-box system, wherein the white-box system performs a keyed cryptographic operation mapping an input message to an output message, wherein the input message comprises m input data and the output message comprises m output data and wherein the cryptographic operation includes at least one round and the cryptographic operation specifies a substitution box for mapping input data into output data, the non-transitory machine-readable storage medium, comprising:
 instructions for transforming each of the m input data into n output data using n split substitution boxes, wherein the n split substitution boxes sum to the specified substitution box and wherein the output data of the n split substitution boxes is secretly encoded and the encoding is different for each of the n split substitution boxes, wherein the secret encoding is integrated into the n split substitution boxes and the secret encoding hides the output value of the n split substitution boxes from an attacker; and 
 instructions for mixing and combining the m×n encoded output data. 
 
     
     
       12. The non-transitory machine-readable storage medium of  claim 11 , further comprising m sets of n split substitution boxes, wherein all of the sets of n split substitution boxes applied to each of the plurality of input data are different from one another and the n split substitution boxes sum to the specified substitution box. 
     
     
       13. The non-transitory machine-readable storage medium of  claim 11 , further comprising m sets of n split substitution boxes, wherein at least two of the sets of n split substitution boxes applied to each of the plurality of input data are different from one another and the n split substitution boxes sum to the specified substitution box. 
     
     
       14. The non-transitory machine-readable storage medium of  claim 11 , wherein instructions for mixing and combining the m×n encoded output data includes at least one of the n outputs of each of the m sets of outputs is combined with at least one output of another set n outputs before the at least one of the n outputs is combined with the remaining n−1 outputs of its set of outputs. 
     
     
       15. The non-transitory machine-readable storage medium of  claim 11 , wherein the input data is unencoded data input into a first round of the keyed cryptographic operation. 
     
     
       16. The non-transitory machine-readable storage medium of  claim 11 , wherein the combined output data is used to calculate a portion of the output message, wherein the output message is an unencoded output of the last round of the keyed cryptographic operation. 
     
     
       17. The non-transitory machine-readable storage medium of  claim 11 , wherein the cryptographic operation is the Advanced Encryption Standard. 
     
     
       18. The non-transitory machine-readable storage medium of  claim 11 , wherein the cryptographic operation is the Data Encryption Standard. 
     
     
       19. The non-transitory machine-readable storage medium of  claim 11 , wherein instructions for transforming an input data into n output data using n split substitution boxes is implemented using a n lookup tables corresponding to the n split substitution boxes, wherein the n lookup tables combine the n split substitution boxes with a cryptographic key. 
     
     
       20. The non-transitory machine-readable storage medium of  claim 11 , wherein instructions for transforming an input data into n output data using n split substitution boxes is implemented using a n finite state machines corresponding to the n split substitution boxes, wherein the n finite state machines combine the n split substitution boxes with a cryptographic key. 
     
     
       21. A method of producing a white-box implementation of a cryptographic operation mapping an input message to an output message in a white-box system, wherein the input message comprises m input data and the output message comprises m output data and wherein the cryptographic operation includes at least one round and the cryptographic operation specifies a substitution box for mapping input data into output data, comprising:
 producing a white-box implementation of the keyed cryptographic operation further comprising: 
 producing n split substitution boxes, wherein the n split substitution boxes sum to the specified substitution box and wherein the output data of the n split substitution boxes is secretly encoded and the encoding is different for each of the n split substitution boxes, wherein the secret encoding is integrated into the n split substitution boxes and the secret encoding hides the output value of the n split substitution boxes from an attacker; and 
 implementing the mixing and the combining of the m×n encoded output data in the white-box system. 
 
     
     
       22. The method of  claim 21 , wherein the split substitution boxes further comprises m sets of n split substitution boxes, wherein all of the sets of n split substitution boxes applied to each of the plurality of input data are different from one another and the n split substitution boxes sum to the specified substitution box. 
     
     
       23. The method of  claim 21 , wherein the split substitution boxes further comprises m sets of n split substitution boxes, wherein at least two of the sets of n split substitution boxes applied to each of the plurality of input data are different from one another and the n split substitution boxes sum to the specified substitution box. 
     
     
       24. The method of  claim 21 , wherein mixing and combining the m×n encoded output data includes at least one of the n outputs of each of the m sets of outputs is combined with at least one output of another set n outputs before the at least one of the n outputs is combined with the remaining n−1 outputs of its set of outputs. 
     
     
       25. The method of  claim 21 , wherein the input data is unencoded data input into a first round of the keyed cryptographic operation. 
     
     
       26. The method of  claim 21 , wherein the combined output data is used to calculate a portion of the output message, wherein the output message is an unencoded output of the last round of the keyed cryptographic operation. 
     
     
       27. The method of  claim 21 , wherein the cryptographic operation is the Advanced Encryption Standard. 
     
     
       28. The method of  claim 21 , wherein the cryptographic operation is the Data Encryption Standard. 
     
     
       29. The method of  claim 21 , wherein the n split substitution boxes are implemented using n lookup tables corresponding to the n split substitution boxes, wherein the n lookup tables combine the n split substitution boxes with a cryptographic key. 
     
     
       30. The method of  claim 21 , wherein the n split substitution boxes are implemented using n finite state machines corresponding to the n split substitution boxes, wherein the n finite state machines combine the n split substitution boxes with a cryptographic key.

Cited by (0)

No later patents cite this yet.

References (0)

No backward citations on record.